How to pass credentials

[adrianlzt]

Hi!

Thanks for the project!
I was looking for a MCP ssh server and this one looks promising.

One thing I do not get is how are you passing the credentials data.
If I run this server as podman, it does not have access to local ssh key files.

I can rely on the LLM being smart to check the .ssh/config files, but is slow.

How do you handle it?

[mingyang91]

If you run an SSH client in a container, you should mount your ./ssh into the container. For example:

docker run -v ~/.ssh:/home/ssh-mcp/.ssh:ro -p 8000:8000 ssh-mcp

Then call ssh_connect with the key_path argument:

{
  "method": "tools/call",
  "params": {
    "name": "ssh_connect",
    "arguments": {
      "address": "<HOST>:<PORT>",
      "key_path": "/home/ssh-mcp/.ssh/id_ed25519",
      "username": "<USER>"
    }
  }
}

[adrianlzt]

My question is more oriented on how you use your MCP client so it fills that info correctly. At the beginning I thought your MCP server would try to parse the ssh config file so the llm could list the available servers and the choose one. El sáb, 21 jun 2025, 16:19, Ming Yang ***@***.***> escribió:

…

*mingyang91* left a comment (mingyang91/ssh-mcp#2) <#2 (comment)> If you run an SSH client in a container, you should mount your ./ssh into the container. For example: docker run -v ~/.ssh:/home/ssh-mcp/.ssh:ro -p 8000:8000 ssh-mcp Then call ssh_connect with the key_path argument: { "method": "tools/call", "params": { "name": "ssh_connect", "arguments": { "address": "<HOST>:<PORT>", "key_path": "/home/ssh-mcp/.ssh/id_ed25519", "username": "<USER>" } } } — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAYWPGH4KAVUEMSLFOGZRY33EVSXZAVCNFSM6AAAAAB7YTKRUCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSOJTGYYDKNZYGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[mingyang91]

docker run -v ~/.ssh:/home/ssh-mcp/.ssh:ro -p 8000:8000 ssh-mcp

This is my approach.

Reading a user's private SSH key is a highly sensitive operation and poses significant security risks. Therefore, I would never do this lightly.

If you need to provide SSH access inside a container, you should either mount the entire ~/.ssh directory or, more securely, mount only the specific private key file (e.g., ~/.ssh/id_rsa) as read-only. This way, the user explicitly grants limited read permission to the ssh-mcp container, understanding the potential risks involved.

Always be cautious and ensure you trust the container environment before sharing sensitive credentials.

[mingyang91]

I also haven’t tried reading .ssh/config—it contains sensitive info like server IPs and ports.

Personally, I store server details in cursor’s project-level rules or a README.md, e.g.:

Development environment for this project  
server ip: 192.168.1.100  
username: root  
key_path: `/home/ssh-mcp/.ssh/id_rsa`  

This way the LLM knows which server each repo uses.

Let me know if that works for you!

[adrianlzt]

Thanks for the idea. My workflow is quite different. I wanted to use it more for as a sysadmin agent, being able to access a lot of different hosts. So having to redefine the hosts in another file is not very practical. El mié, 25 jun 2025 a las 5:45, Ming Yang ***@***.***>) escribió:

…

*mingyang91* left a comment (mingyang91/ssh-mcp#2) <#2 (comment)> I also haven’t tried reading .ssh/config—it contains sensitive info like server IPs and ports. Personally, I store server details in cursor’s project-level rules or a README.md, e.g.: Development environment for this project server ip: 192.168.1.100 username: root key_path: `/home/ssh-mcp/.ssh/id_rsa` This way the LLM knows which server each repo uses. Let me know if that works for you! — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAYWPGFYF4ZMVUXH627MOQ33FILOFAVCNFSM6AAAAAB7YTKRUCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMBSHA3TQMZSGQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[MiccoHadje]

flow is quite different. I wanted to use it more for as a sysadmin agent, being able to access a lot of different hosts. So having to redefine the hosts in another file is not very practical.

Perhaps create an MCP server for each host, each pointing to the necessary host address & keyfile? There is nothing stopping you from having several entries in your AI's config file all pointing to the same server, but with different object names and arguments. I haven't tried with this mcp implementation, but his has worked for me in other circumstances (for instance, different database connections.) It's easy for the ai to then just reference that tool set to talk to that machine.

[adrianlzt]

This is not very practical, as I have more than 50 hosts that could be accessed.
I was thinking in another MCP server to provide credentials, or extending this one with another tool for that.